Decoupling Protection from Privilege Level in Computer Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems lack a flexible and fine-grained protection mechanism for information, as existing methods either introduce significant overhead or destabilize the kernel when trying to protect application code and data from undesirable access, and they do not allow for non-linear relationships between code portions and protection levels.
Innovation Solution
The solution involves decoupling protection from privilege levels by dividing code and data into domains with customizable domain attributes, allowing for flexible protection relationships without requiring context switching, thus enabling high protection levels at low privilege levels without kernel involvement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is moved to kernel level for protection, then protection level is improved, but system overhead and kernel complexity increase
Solution Approach 1:
The patent segments the code base into distinct domains (e.g., kernel domain, application domain, library domain) that can coexist at the same privilege level. Each domain is assigned unique domain attributes including domain identifiers and protection keys, allowing fine-grained access control without requiring kernel-level elevation. This segmentation enables protected code to remain in user space while maintaining security through domain boundaries.
2Reliability
If context switching is used to enforce protection, then protection is achieved, but performance overhead increases
Solution Approach 1:
The protection mechanism operates autonomously within the user level without requiring kernel intervention. The domain attribute system automatically enforces protection rules through hardware-supported domain identifiers and protection keys that are checked during memory access operations. This self-service approach eliminates context switching overhead while maintaining protection, as the mechanism resolves access control decisions locally without kernel involvement.
3Device complexity
If linear privilege levels are used, then protection hierarchy is simplified, but flexibility in defining protection relationships is reduced
Solution Approach 1:
The patent introduces a new dimension for protection relationships through domain attributes that are independent of the traditional privilege level hierarchy. Instead of relying solely on linear privilege rings, the system uses domain identifiers and protection keys as additional dimensions to define access relationships. This allows non-linear, many-to-many protection relationships between code portions while maintaining a simple privilege level structure.
Data Source
AI summary
Methods and systems for providing a flexible protection model in a computer system by decoupling protection from privilege are described. Information describing a relationship between the two or more domains that define types of protection and portions of code is received. The portions of code with the multiple domains that provide fine granularities of protection can be executed in the same privilege level. The relationship is not required to be linear. In addition, the overhead associated with crossing protection domains is relatively low with respect to traditional operating system context switching overhead.